1. photon
  2. Commit 41c9290e3be4da47f439555659981a7539e0f353
Browse code

CVE-2018-14647 - python2

Change-Id: I6e4c8562e474ddcfde348a086170599df52ac1b5
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6413
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

Tapas Kundu authored on 2018/12/22 05:43:20
Showing 2 changed files
SPECS/python2/CVE-2018-14647.patch
History View file @ 41c9290
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,84 @@
0 
+commit 18b20bad75b4ff0486940fba4ec680e96e70f3a2
1 
+Author: Christian Heimes <christian@python.org>
2 
+Date:   Tue Sep 18 15:13:09 2018 +0200
3 
+
4 
+    [2.7] bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146) (GH-9394)
5 
+
6 
+
7 
+
8 
+    The C accelerated _elementtree module now initializes hash randomization
9 
+    salt from _Py_HashSecret instead of libexpat's default CPRNG.
10 
+
11 
+    Signed-off-by: Christian Heimes <christian@python.org>
12 
+
13 
+    https://bugs.python.org/issue34623.
14 
+    (cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b)
15 
+
16 
+    Co-authored-by: Christian Heimes <christian@python.org>
17 
+
18 
+
19 
+
20 
+    https://bugs.python.org/issue34623
21 
+
22 
+diff --git a/Include/pyexpat.h b/Include/pyexpat.h
23 
+index 5340ef5..3fc5fa5 100644
24 
+--- a/Include/pyexpat.h
25 
+@@ -3,7 +3,7 @@
26 
+
27 
+ /* note: you must import expat.h before importing this module! */
28 
+
29 
+-#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.0"
30 
++#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.1"
31 
+ #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI"
32 
+
33 
+ struct PyExpat_CAPI
34 
+@@ -43,6 +43,8 @@ struct PyExpat_CAPI
35 
+         XML_Parser parser, XML_UnknownEncodingHandler handler,
36 
+         void *encodingHandlerData);
37 
+     void (*SetUserData)(XML_Parser parser, void *userData);
38 
++    /* might be none for expat < 2.1.0 */
39 
++    int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt);
40 
+     /* always add new stuff to the end! */
41 
+ };
42 
+
43 
+diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
44 
+new file mode 100644
45 
+index 0000000..31ad92e
46 
+--- /dev/null
47 
+@@ -0,0 +1,2 @@
48 
++The C accelerated _elementtree module now initializes hash randomization
49 
++salt from _Py_HashSecret instead of libexpat's default CSPRNG.
50 
+diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
51 
+index f7f992d..b38e0ab 100644
52 
+--- a/Modules/_elementtree.c
53 
+@@ -2574,6 +2574,11 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw)
54 
+         PyErr_NoMemory();
55 
+         return NULL;
56 
+     }
57 
++    /* expat < 2.1.0 has no XML_SetHashSalt() */
58 
++    if (EXPAT(SetHashSalt) != NULL) {
59 
++        EXPAT(SetHashSalt)(self->parser,
60 
++                           (unsigned long)_Py_HashSecret.prefix);
61 
++    }
62 
+
63 
+     ALLOC(sizeof(XMLParserObject), "create expatparser");
64 
+
65 
+diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
66 
+index 2b4d312..1f8c0d7 100644
67 
+--- a/Modules/pyexpat.c
68 
+@@ -2042,6 +2042,11 @@ MODULE_INITFUNC(void)
69 
+     capi.SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler;
70 
+     capi.SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler;
71 
+     capi.SetUserData = XML_SetUserData;
72 
++#if XML_COMBINED_VERSION >= 20100
73 
++    capi.SetHashSalt = XML_SetHashSalt;
74 
++#else
75 
++    capi.SetHashSalt = NULL;
76 
++#endif
77 
+
78 
+     /* export using capsule */
79 
+     capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL);
SPECS/python2/python2.spec
History View file @ 41c9290
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        A high-level scripting language
2 2 
 Name:           python2
3 3 
 Version:        2.7.15
4 
-Release:        2%{?dist}
4 
+Release:        3%{?dist}
5 5 
 License:        PSF
6 6 
 URL:            http://www.python.org/
7 7 
 Group:          System Environment/Programming
... ... 
@@ -12,7 +12,7 @@ Source0:        http://www.python.org/ftp/python/%{version}/Python-%{version}.ta
12 12 
 Patch0:         cgi.patch
13 13 
 Patch1:         added-pyopenssl-ipaddress-certificate-validation.patch
14 14 
 Patch2:         python2-support-photon-platform.patch
15 
-
15 
+Patch3:         CVE-2018-14647.patch
16 16 
 BuildRequires:  pkg-config >= 0.28
17 17 
 BuildRequires:  bzip2-devel
18 18 
 BuildRequires:  openssl-devel
... ... 
@@ -113,6 +113,7 @@ The test package contains all regression tests for Python as well as the modules
113 113 
 %patch0 -p1
114 114 
 %patch1 -p1
115 115 
 %patch2 -p1
116 
+%patch3 -p1
116 117
117 118 
 %build
118 119 
 export OPT="${CFLAGS}"
... ... 
@@ -235,6 +236,8 @@ make test
235 235 
 %{_libdir}/python2.7/test/*
236 236
237 237 
 %changelog
238 
+*   Fri Dec 21 2018 Tapas Kundu <tkundu@vmware.com> 2.7.15-3
239 
+-   Fix for CVE-2018-14647
238 240 
 *   Mon Sep 17 2018 Dweep Advani <dadvani@vmware.com> 2.7.15-2
239 241 
 -   Remove vulnerable Windows installers from python-libs rpm
240 242 
 *   Fri Aug 17 2018 Dweep Advani <dadvani@vmware.com> 2.7.15-1